Network security operation and maintenance management method and device, computing equipment and storage medium
An operation and maintenance management and network security technology, applied in the field of network security, can solve problems such as information leakage, safe operation and processing without network attacks, and equipment terminals that cannot work normally, so as to achieve the effect of convenient processing and realization of operation and maintenance management
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment approach 1
[0031] Embodiment 1: Identify according to multiple threat information, and obtain alarm information corresponding to the same attack node. For any attack node, the threat intelligence corresponding to the attack node is aggregated to generate alarm information corresponding to the attack node. In this implementation, the threat intelligence corresponding to the same attack node is directly aggregated into the alarm information of an event, so that an alarm information of an event corresponds to an attack node, and can be obtained through this event in a comprehensive and customized manner. The alarm information of the attack node is conducive to special processing for each attack node. In the actual implementation process, an attack node can correspond to one or more identification rules. When an attack node can correspond to one identification rule, the corresponding attack node can be determined by matching the threat intelligence with the identification rule; when an attac...
Embodiment approach 2
[0032] Embodiment 2: Identify according to multiple threat intelligences, and obtain threat events corresponding to the same attack node. A plurality of associated attack nodes is obtained; threat events corresponding to the plurality of attack nodes are aggregated. Wherein, the multiple associated attack nodes correspond to the same attack scenario. In this embodiment, specifically, the threat events corresponding to the same attack scenario are aggregated. Adopting this implementation manner can fully reflect the attack characteristics of the attack scenario, and facilitate specialized analysis and processing of different attack scenarios. In the specific implementation process, the attack nodes involved in different attack scenarios can be pre-determined. For example, in the attack scenario P targeting the terminal USER1, it usually involves the early high-risk port scanning node (attack node A), the mid-term High-risk port attack node (attack node B), and later log clean...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More